CVE-2018-25429
Description
Paroiciel 11.20 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the zProIdPro parameter. Attackers can send GET requests to zpro.php with crafted SQL payloads in the zProIdPro parameter to extract sensitive database information including usernames, databases, and version details.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The application does not properly sanitize user-supplied input in the zProIdPro parameter, allowing for SQL injection."
Attack vector
An authenticated attacker can exploit this vulnerability by sending a crafted GET request to the zpro.php script. By injecting SQL code into the `zProIdPro` parameter, the attacker can manipulate database queries. This allows for the extraction of sensitive information such as usernames, database names, and version details [ref_id=1]. The exploit targets the `zProAction=M` endpoint to trigger the vulnerable code path [ref_id=1].
Affected code
The vulnerability exists in the zpro.php script, specifically when handling the `zProIdPro` parameter. The provided reference indicates that the `zProAction=M` parameter is used in conjunction with the vulnerable `zProIdPro` parameter to execute arbitrary SQL queries [ref_id=1].
What the fix does
The provided bundle does not contain information about a patch or specific remediation steps. Therefore, the advisory does not specify how the vulnerability is fixed. Users are advised to consult vendor advisories for the latest security updates and patches.
Preconditions
- authThe attacker must be authenticated to the application.
Reproduction
1. Send a GET request to `/[PATH]/html/zpro.php?zProAction=M&zProIdPro=-2' UNION ALL SELECT 1,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),3,4,5,6,7,8,9,10-- -` [ref_id=1]. 2. Observe the response for extracted database information.
Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4News mentions
0No linked articles in our index yet.